[5.7,026/120] drm/dbi: Fix SPI Type 1 (9-bit) transfer

Message ID	20200803121904.119635279@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=5b7Y=BN=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Paul Cercueil <paul@crapouillou.net>, Sam Ravnborg <sam@ravnborg.org>, =?utf-8?q?Noralf_Tr=C3=B8nnes?= <noralf@tronnes.org> Subject: [PATCH 5.7 026/120] drm/dbi: Fix SPI Type 1 (9-bit) transfer Date: Mon, 3 Aug 2020 14:18:04 +0200 Message-Id: <20200803121904.119635279@linuxfoundation.org> In-Reply-To: <20200803121902.860751811@linuxfoundation.org> References: <20200803121902.860751811@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,004/120] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with A... [5.7,007/120] ALSA: hda/realtek - Fixed HP right speaker no sound [5.7,008/120] ALSA: hda: Workaround for spurious wakeups on some Intel platforms [5.7,009/120] ALSA: hda/hdmi: Fix keep_power assignment for non-component devices [5.7,011/120] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE [5.7,012/120] vhost/scsi: fix up req type endian-ness [5.7,014/120] revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") [5.7,016/120] ARM: 8987/1: VDSO: Fix incorrect clock_gettime64 [5.7,019/120] ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect [5.7,020/120] virtio_balloon: fix up endian-ness for free cmd id [5.7,022/120] ARM: percpu.h: fix build error [5.7,024/120] drm/amd/display: Clear dm_state for fast updates [5.7,025/120] drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() [5.7,026/120] drm/dbi: Fix SPI Type 1 (9-bit) transfer [5.7,027/120] drm/mcde: Fix stability issue [5.7,029/120] drm: of: Fix double-free bug [5.7,031/120] random32: remove net_rand_state from the latent entropy gcc plugin [5.7,033/120] libtraceevent: Fix build with binutils 2.35 [5.7,037/120] ARM: dts sunxi: Relax a bit the CMA pool allocation range [5.7,039/120] espintcp: recv() should return 0 when the peer socket is closed [5.7,042/120] nvme-tcp: fix possible hang waiting for icresp response [5.7,043/120] selftests/net: rxtimestamp: fix clang issues for target arch PowerPC [5.7,045/120] selftests/net: so_txtime: fix clang issues for target arch PowerPC [5.7,046/120] selftests/net: tcp_mmap: fix clang warning for target arch PowerPC [5.7,050/120] net: hns3: fix a TX timeout issue [5.7,051/120] net: hns3: add reset check for VF updating port based VLAN [5.7,054/120] net/mlx5: E-switch, Destroy TSAR when fail to enable the mode [5.7,056/120] net/mlx5e: Fix error path of device attach [5.7,057/120] net/mlx5: Fix a bug of using ptp channel index as pin index [5.7,059/120] net/mlx5: Query PPS pin operational status before registering it [5.7,062/120] net: lan78xx: add missing endpoint sanity check [5.7,063/120] net: lan78xx: fix transfer-buffer memory leak [5.7,065/120] mlx4: disable device on shutdown [5.7,067/120] octeontx2-pf: cancel reset_task work [5.7,069/120] bareudp: forbid mixing IP and MPLS in multiproto mode [5.7,071/120] mlxsw: core: Increase scope of RCU read-side critical section [5.7,072/120] mlxsw: core: Free EMAD transactions using kfree_rcu() [5.7,073/120] mlxsw: spectrum_router: Fix use-after-free in router init / de-init [5.7,075/120] ibmvnic: Fix IRQ mapping disposal in error path [5.7,076/120] bpf: Fix map leak in HASH_OF_MAPS map [5.7,079/120] mac80211: mesh: Free pending skb when destroying a mpath [5.7,080/120] RDMA/core: Stop DIM before destroying CQ [5.7,083/120] arm64: csum: Fix handling of bad packets [5.7,086/120] net: nixge: fix potential memory leak in nixge_probe() [5.7,087/120] net: ethernet: mtk_eth_soc: fix MTU warnings [5.7,091/120] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq [5.7,094/120] mt76: mt7615: fix lmac queue debugsfs entry [5.7,095/120] iwlwifi: fix crash in iwl_dbg_tlv_alloc_trigger [5.7,096/120] usb: hso: Fix debug compile warning on sparc32 [5.7,101/120] habanalabs: prevent possible out-of-bounds array access [5.7,103/120] scsi: core: Run queue in case of I/O resource contention failure [5.7,104/120] riscv: kasan: use local_tlb_flush_all() to avoid uninitialized __sbi_rfence [5.7,106/120] net: ethernet: ravb: exit if re-initialization fails in tx timeout [5.7,109/120] i2c: cadence: Clear HOLD bit at correct time in Rx path [5.7,111/120] x86/stacktrace: Fix reliable check for empty user task stacks [5.7,112/120] cxgb4: add missing release on skb in uld_send() [5.7,113/120] xen-netfront: fix potential deadlock in xennet_remove() [5.7,118/120] KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled [5.7,119/120] KVM: SVM: Fix disable pause loop exit/pause filtering capability on SVM

Message ID

20200803121904.119635279@linuxfoundation.org

State

New

Headers

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org,
	Paul Cercueil <paul@crapouillou.net>, 
	Sam Ravnborg <sam@ravnborg.org>, =?utf-8?q?Noralf_Tr=C3=B8nnes?=
	<noralf@tronnes.org>
Subject: [PATCH 5.7 026/120] drm/dbi: Fix SPI Type 1 (9-bit) transfer
Date: Mon,  3 Aug 2020 14:18:04 +0200
Message-Id: <20200803121904.119635279@linuxfoundation.org>
In-Reply-To: <20200803121902.860751811@linuxfoundation.org>
References: <20200803121902.860751811@linuxfoundation.org>
User-Agent: quilt/0.66
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Sender: stable-owner@vger.kernel.org
Precedence: bulk

Series

None | expand

Commit Message

Greg KH Aug. 3, 2020, 12:18 p.m. UTC

From: Paul Cercueil <paul@crapouillou.net>

commit 900ab59e2621053b009f707f80b2c19ce0af5dee upstream.

The function mipi_dbi_spi1_transfer() will transfer its payload as 9-bit
data, the 9th (MSB) bit being the data/command bit. In order to do that,
it unpacks the 8-bit values into 16-bit values, then sets the 9th bit if
the byte corresponds to data, clears it otherwise. The 7 MSB are
padding. The array of now 16-bit values is then passed to the SPI core
for transfer.

This function was broken since its introduction, as the length of the
SPI transfer was set to the payload size before its conversion, but the
payload doubled in size due to the 8-bit -> 16-bit conversion.

Fixes: 02dd95fe3169 ("drm/tinydrm: Add MIPI DBI support")
Cc: <stable@vger.kernel.org> # 5.4+
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Noralf Trønnes <noralf@tronnes.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20200703141341.1266263-1-paul@crapouillou.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_mipi_dbi.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/drm_mipi_dbi.c
+++ b/drivers/gpu/drm/drm_mipi_dbi.c
@@ -938,7 +938,7 @@  static int mipi_dbi_spi1_transfer(struct
 			}
 		}
 
-		tr.len = chunk;
+		tr.len = chunk * 2;
 		len -= chunk;
 
 		ret = spi_sync(spi, &m);

[5.7,026/120] drm/dbi: Fix SPI Type 1 (9-bit) transfer

Commit Message

Patch